Presently, a large amount of day-to-day work is carried out on networks such as the Internet or Local Area Networks (LAN's), which are often connected to the Internet. As a result it has become increasingly necessary for users to login to servers connected to such networks. The threat of server intrusion and data theft are a high priority for many server administrators. As a result, many people need to go through an authentication process before being able to use resources provided by a server. The inconvenience and downtime associated with loss of passwords is well known. However, it is necessary for server administrators to maintain suitable levels of security, particularly as intruders become more sophisticated.
There are currently a wide variety of web-based applications that offer user authentication. Most commonly, present web-based applications check user identification and a secret password. Further developments provide for blocking of user access after a predetermined number of unsuccessful login attempts and/or offering a user who has forgotten the user identification and/or the password some means to recover that information. Those means are often in the form of a question to which the answer has already been provided by a user. These are known as password hints and are in wide use today. A possible problem with this type of system has to do with convenience. It can be annoying to a user if he or she has to answer a question after having provided an incorrect password and/or identification once or twice. On the other hand, allowing the entry of an incorrect password and/or identification too many times without taking protective action can compromise the security of the computer system being accessed.
Another way in which access is controlled is by the use of Reverse Turing Tests or RTTs'. These tests mandate human participation and are thus intended to inhibit access by automated programs or scripts. An example of such a test is to display a distorted code of a number of symbols and to request the user to enter that code. The distorted code is not recognized by an automated program or script. RTT's are particularly useful for defending against computerized attacks. However, they are not capable of distinguishing with any degree of probability that a human user of a computer is an authorized user of that computer. The reason for that is that any human user can make out the distorted code. Such RTT's are thus susceptible to attacks by teams of human users. Also, they do not adjust convenience of use for authentic users that login correctly over a period of time.
International Patent Publication WO 01/90859 A1 discloses an adaptive multi-tier authentication system. The system provides secondary tiers of authentication which are used only when the user attempts a connection from a new environment. User/usage profiles are kept for each user and the user login information is compared to the information from the user/usage profile for the specific user which contains all of the user information that the user used to establish the account and also the usage profile detailing the user's access patterns. The trust level of the current user login location is calculated and the invention determines if any additional questions to the user are required.
United States Patent Publication US 2002/0112184 A1 discloses a system that can be used to monitor for an attempted intrusion of an access system. The system detects an access system event in the access system and determines whether the access system event is of a type that is being monitored. If the access system event is of a type that is being monitored, the system reports information about the access system event. In one implementation, the access system includes identity management and access management functionality. In another embodiment, the access system includes access management functionality and not identity management functionality. The access system event can be an authentication success event, authentication failure event, or other suitable event.
International Patent Publication WO 01/22201 A1 discloses context sensitive dynamic authentication in a cryptographic system. It discloses a system for performing authentication of a first user to a second user that includes the ability for the first user to submit multiple instances of authentication data which are evaluated and then used to generate an overall level of confidence in the claimed identity of the first user. The individual authentication instances are evaluated based upon: the degree of match between the user provided by the first user during the authentication and the data provided by the first user during his enrollment; the inherent reliability of the authentication technique being used; the circumstances surrounding the generation of the authentication data by the first user; and the circumstances surrounding the generation of the enrollment data by the first user. This confidence level is compared with a required trust level which is based at least in part upon the requirements of the second user, and the authentication result is based on this comparison.
A particular problem with the above publications is that they do not provide a means whereby an established authentic user can experience a convenient login process as opposed to a relatively new user or group of users, which could be non-authentic.